Dashboard / CVE-2026-123995

CVE-2026-123995

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 45/100
Published: 2026-11-06 Modified: 2026-11-12 First seen: 2026-11-06 Status: active

Attack Surface

Adjacent Low Complexity No Auth

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: Active
S: X
AT: None
VC: Low
VI: Low
VA: None

Description

Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validating the scheme, host, or media legitimacy. Attackers can supply schemes such as http://, file:///data/misc/wifi/, rtsp://, or smb:// to have the TV fetch and render attacker-controlled content after a one-time DLNA pairing, enabling phishing pages, fake firmware prompts, and fake emergency alerts to be displayed, with subsequent commands executing silently.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
Hisense VIDAA 0000.01.00a.P0220
Hisense VIDAA 0000.01.00a.P0220

References & Advisories (2)

Bug Bounty Relevance

45 / 100
✓ No authentication
✓ Low complexity

CVSS Score

4.8 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.13%
Raw Score 0.001330
Percentile 2.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00133
2026-11-12
0.00133
2026-11-10
0.00133
2026-11-09
0.00133
2026-11-08
0.00133
2026-11-07
0.00133

Intelligence Sources

mitre ref →
nvd ref →

External Links